What is the CVSS score of CVE-2025-46308?

CVE-2025-46308 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2025-46308?

Yes, a patch is available for CVE-2025-46308. Update the affected software to the latest version immediately.

iOS iPadOS macOS CVE-2025-46308

EUVD-2025-210110 MEDIUM

Improper Access Control (CWE-284)

2026-06-11 apple

GHSA-47w7-9fq8-cxp2

Authentication Bypass Apple Ios And Ipados

5.3

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.3 LOW

App-based local attack (AV:L), user must install the app (UI:R), only limited confidentiality impact; no integrity or availability impact applies.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 11, 2026 - 21:34 vuln.today

CVSS changed

Jun 11, 2026 - 20:22 NVD

5.3 (MEDIUM)

Patch available

Jun 11, 2026 - 20:01 EUVD

CVE Published

Jun 11, 2026 - 18:47 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 11, 2026 - 18:47 cve.org

MEDIUM 5.3

DescriptionCVE.org

An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to leak sensitive user information.

AnalysisAI

Improper access control via flawed authorization state management in Apple iOS/iPadOS (before 18.4) and macOS Sequoia (before 15.4) permits a locally installed app to leak sensitive user information without proper authorization. Fixed in iOS 18.4, iPadOS 18.4, and macOS Sequoia 15.4, as confirmed by Apple security advisories. No public exploit code has been identified and no active exploitation is recorded in CISA KEV at time of analysis, though SSVC flags the vulnerability as automatable with partial technical impact.

Technical ContextAI

The root cause is classified as CWE-284 (Improper Access Control), specifically manifesting as a defect in authorization state management within Apple's iOS/iPadOS and macOS operating system frameworks. State management flaws in authorization contexts typically occur when a security-relevant state (e.g., permission grant, session context, entitlement check result) is cached, propagated, or evaluated incorrectly across application lifecycle events - such as app suspension, resume, or inter-process communication. Affected CPEs are cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:* (all versions below 18.4) and cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* (all versions below 15.4 Sequoia). The 'Authentication Bypass' tag suggests the flaw allows an app to bypass intended authorization gates to access data it should not have permission to read.

RemediationAI

Vendor-released patch: iOS 18.4 and iPadOS 18.4 (apply via Settings > General > Software Update) and macOS Sequoia 15.4 (apply via System Settings > General > Software Update). These updates address the authorization state management flaw as confirmed by Apple. For devices that cannot be updated immediately, restrict installation of untrusted or third-party apps - on iOS/iPadOS this means reviewing App Store permissions and avoiding sideloaded apps if enterprise policies allow it. On macOS, enabling Gatekeeper and limiting app installations to the Mac App Store reduces exposure. These mitigations limit the attack surface but do not eliminate the underlying flaw. Advisory references: https://support.apple.com/en-us/122371 (iOS/iPadOS) and https://support.apple.com/en-us/122373 (macOS).